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Amendments to the Claims: 

This listing of claims will replace all prior versions, and 
listings, of claims in the application: 

1. (CURRENTLY AMENDED) A method of' determining, in a 
communications network, an upstream station, among several other 
candidates, traversed by a packet having a TTL field arriving at a 
downstream station, comprising the steps of: 

a) marking the TTL field of the packet flow arriving at the 
upstream station [ [,] ] in a manner that uniquely identifies the 
upstream station among all the other concurrently marking 
upstream stations so that the TTL field may be used as a 
covert channel : 

b) receiving and identifying at the downstream station a marked 
packet flow; 

c) determining, depending upon the TTL field of the marked packet 
flow received, that said packet flow traversed the upstream 
station. 

2. (ORIGINAL) The method as defined in claim 1 wherein step 
c) involves comparing the value of the TTL field of packets in a 
flow to which said packets belong with and without marking being 
performed, thereby enabling the manner of marking, which identifies 
the upstream station, to be determined. 
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3. (ORIGINAL) The method as defined in claim 2 wherein 
packets are marked at each selected station by a single static 
value assigned by an external entity. 

4. (ORIGINAL) The method as defined in claim 2 wherein 
packets are marked at each selected station by a single dynamic 
value assigned by an external entity. 

5. (ORIGINAL) The method as defined in claim 2 wherein 
packets are marked at each selected station by plural dynamic 
values and associated marking scheme assigned by an external 
entity. 

6. (ORIGINAL) The method as defined in claim 5 wherein the 
application of a value to the TTL field is one of add, subtract and 
replace . 

7. (CURRENTLY AMENDED) The method aa defined in claim 1 A method 
of determining , in a communications network, an upstream station, 
among several other candidates, traversed by a packet having a TTL 
field arriving at a downstream station, comprising the steps of: 
al marking the TTL field of the packet flow arriving at the 

upstream station, in a manner that uniquely identifies the 
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upstream station among all the other concurrently marking 
upstream stations; 
bl receiving and identifying at the downstream station a marked 
packet flow: 

cl determining, depending upon the TTL field of the marked packet 
flow recei ved, that said packet flow traversed the upstream 
station: 

wherein the TTL field of the marked packet is identified by looking 
for [ [a] ] constant shifts in statistical parameters and in the 
distributed TTL value with marking turned on and turned off. 

8. (ORIGINAL) The method as defined in claim 7 wherein step 
c) involves comparing the value of the TTL field of packets in a 
flow to which said packets belong with and without marking being 
performed, thereby enabling the manner of marking, which identifies 
the upstream station, to be determined. 

9. (CURRENTLY AMENDED) The method as defined in claim 2 claim 10 
wherein for flows with randomized TTL values the marked packet is 
identified by looking for constant shifts in parameters of 
statistical distribution of TTL values with marking turned on and 
turned off. 
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10. (CURRENTLY AMENDED) The method ao defined in claim 2 A method 
of determining , in a communications network, an upstream station. 
among several other can didates, traversed by a packet having a TTL 
field arriving at a downstream station, comprising the steps of: 
a! marking the TTL field of the packet flow arriving at the 

upstream station in a manner that uniquely identifies the 

upstream station among all the other concurrently marking 

upstream stations; 
fe! receiving and i dentifying at the downstream station a marked 

packet flow: 

cl determining, depending upon the TTL field of the marked packet 
flow recei ved, that said packet flow traversed the upstream 
station; and comparing the value of the TTL field of packets 

in a flow to which said packets belong with and without 

marking being performed, thereby enabling the manner of 

marking, which identifies the upstream station, to be 

determined; 

wherein each upstream marking station is assigned k values V. {vj , 
V 2 , - . . VJ and k associated ratios R< {R ir R 2 , . . . R k }, where the sum 
of all k ratios R. is 100%; the marking station marks R; percent of 
the packet flow with a Vj value; thus uniquely identifying its 
marking . 
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11. (CURRENTLY AMENDED) The method as defined in claim 2 claim 10 
wherein the marking station uses [ [N] ] a plurality of different 
marking schema independently for N and wherein marking of packets 
is performed using in succession a different one of said schema 
over a like pl urality of consecutive time windows ; thus uniquely 
identifying its marking . 

12. (CURRENTLY AMENDED) A system for determining, in a 
communications network, an upstream station, among several other 
candidates, traversed by a packet having a TTL field arriving at a 
downstream station, comprising: 

a) means for marking the TTL field of the packet flow arriving at 
the upstream station, in a manner that uniquely identifies the 
upstream station among all the other concurrently marking 
upstream stations; 

b) means for receiving and identifying at the downstream station 
a marked packet flow; 

c) means for determining depending upon the TTL field of the 
marked packet flow received that said packet flow traversed 
the upstream station. 



13. (CURRENTLY AMENDED) The system as defined in claim 12 claim 16 
wherein the value of the marked packet is assigned dynamically by 
an external entity. 
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14. (CURRENTLY AMENDED) The system as defined in claim 12 claim 16 
wherein the upstream station to mark packets is selected by the 
external entity. 

15. (CURRENTLY AMENDED) The system as defined in claim 12 claim 16 
wherein the upstream station to mark packets is selected by a group 
of network edge stations marking concurrently. 

16. (CURRENTLY AMENDED) The oyotcm ao defined in claim 12 A system 
for determining, in a communications network, an upstream station, 
among several other candidates, traversed by a packet arriving at 
a downstream station, comprising: 

aJ_ means for marking the TTL field of the packet flow arriving at 
the upstream stati on, in a manner that uniquely identifies the 
upstream station among all the other concurrently marking 
upstream stations; 
hL means for recei ving and identifying at the downstream station 

a marked packet flow; 
SL means f or determining depending upon the TTL field of the 
marked packet flow received that said packet flow traversed 
the upstream station; 
wherein the upstream station to mark packets is selected by a group 
of network edge stations marking concurrently with a common primary 
mark and one selected station of the group using a secondary unique 
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mark, the selection of the station using the secondary mark 
rotating among stations of the group. 

17. (CURRENTLY AMENDED) The system as defined in claim 12 claim 16 
wherein the downstream station is one of an edge router; a last 
mile router; receiving device and a network management system. 

18. (CURRENTLY AMENDED) The system as defined in claim 12 claim 16 
wherein the upstream station, also referred to as marking station, 
is one of a generic router; a core router; an edge router; a single 
network interface; a last mile router; and a network appliance ouch 
ao a proxy, a firewall, a NAT box, a VPN device . 



